/security
Boring, on purpose.
You're about to upload your entire customer book into a new system. The least we owe you is a clear account of how it's kept: who can see what, where it lives, and how fast we can answer a regulator. No theatre, no badges we haven't earned.
/tenant isolation
Multi-tenant by design
Your data is isolated by the database itself, with row-level security, not a filter someone might forget to write. Cross-tenant access is structurally prevented, and the test suite asserts isolation holds.
/data residency
Region-pinned or self-hosted
Choose a region for hosted deployments, or run the same build in your own cloud for strict residency regimes. Per-tenant encryption contexts keep sensitive fields sealed, and one screen shows where your data lives and which controls are on.
/encryption
At rest and in transit
Encrypted at rest (AES-256) and in transit (TLS 1.2+). Passport numbers, integration credentials and similarly sensitive fields carry their own encryption on top, with keys derived per environment.
/sign-in
More than a password
Two-step verification (TOTP + recovery codes), passwordless sign-in links, re-authentication before sensitive actions, a list of active sessions you can end remotely, and a per-account IP allowlist. Enterprise adds SAML / OIDC single sign-on.
/access control
Modules, actions and field masking
Custom roles on top of owner / admin / member: whole modules switch off (a closed module leaves the menu and won't open by typing the address), actions are permissioned one by one, and field masking hides cost, sell, personal data and passport numbers from roles that shouldn't see them, in exports as well as on screen.
/audit trail
Versioned on every model
Every record is change-logged into an account-scoped history of who, when and what, filterable by record type and user, with some changes reversible. Sign-in attempts and session events are recorded separately.
/erasure + retention
A deletion request that ends correctly
Subject requests (access, rectification, erasure, portability, restriction, objection, plus the KVKK-specific types) run end to end with an SLA countdown. On approval, records the law requires you to keep are retained with the personal data redacted; leads and conversations, which carry no such duty, are deleted outright.
/ai governance
You decide what AI may touch
Disable AI per account, per feature or per data class, pin an EU-only residency, and set a lawful basis per customer; choose "no processing" and no call is ever made about that person. Personal data is tokenised before it leaves for a provider, every call is logged with its basis snapshotted, and the embedding model behind semantic search runs on our own servers.
/abuse detection
Quiet, boring guardrails
Bot protection on the sign-in and sign-up forms, sanctions-country blocks, per-account IP allowlists, and rate limiting on sensitive actions. Security that doesn't get in the operator's way.
/compliance
Regulatory posture
- KVKK
- Turkey
- GDPR
- EU + UK
- CCPA
- California
DPA template + sub-processor registry
Art. 17 erasure + data export self-service
right-to-delete honoured
Jurisdiction-specific DPAs are published at /legal/dpa; the live sub-processor list is at /legal/subprocessors. Data export and account-level erasure are self-service: no support ticket, no hostage-taking.
Due-diligence questions?
Security reviews and DPAs: reach the compliance desk directly at compliance@lydira.com.